Privacy Policy

1. Information We Collect

1a. Information you provide directly

• Account information: Your email address, name, and authentication credentials (password stored as a hash, or third-party OAuth identifier).
• Health and fitness profile: Fitness goals, dietary preferences, physical constraints, injury history, and other profile information you enter manually.
• Weight and body composition: Manual weight entries and body composition data you log.
• Coaching conversations:The text of messages you send to the AI coach and the AI’s responses.
• Support correspondence: Messages you send to our support team.

1b. Apple HealthKit data

With your explicit permission, VividCoach reads the following categories of data from Apple HealthKit:

VividCoach does not write data back to HealthKit unless you explicitly grant write permission for a specific data type.

HealthKit data is read locally on your device and, where necessary to generate AI coaching responses, transmitted over an encrypted connection to our servers for processing. See §6 (Apple HealthKit Disclosure) for the mandatory Apple disclosure and data-handling constraints.

1c. Information collected automatically

• Device and app metadata: Device model, iOS version, app version, time zone, and language setting.
• Usage data: Features used, session duration, screen views, and coaching interaction counts — collected in aggregate and de-identified form.
• Crash and diagnostic data: Error logs and crash reports (no health data included).

2. How We Use Information

We use your information to:

• Provide and personalize AI coaching recommendations (exercise plans, nutrition guidance, recovery suggestions).
• Analyze HealthKit and manually entered data to generate coaching insights.
• Send in-app notifications and coaching nudges you have opted into.
• Process account authentication and manage your account.
• Debug, improve reliability, and develop new features using aggregate or de-identified data.
• Respond to support inquiries.
• Comply with legal obligations.

We do not sell your personal information or health data.
We do not use your health data for advertising purposes.
We do not use your health data to build advertising profiles.

3. How Information Is Shared

We share information only with:

• AI sub-processors that generate coaching responses: Anthropic (Claude API). Coaching context — including relevant HealthKit summaries and conversation history — is sent to Anthropic to generate your coaching responses. See §5 (AI Processing Disclosures).
• Infrastructure sub-processors that host and secure the App: Supabase (database and storage, US region), Vercel (API hosting), Resend (transactional email), and Stripe (payment processing).
• Legal and safety recipients: When required by applicable law, subpoena, or court order, or to protect rights, property, or safety.
• Successors: In connection with a merger, acquisition, or asset sale, with advance notice to you.

We do not share HealthKit data with third parties for any purpose other than providing your coaching service. We do not share HealthKit data with data brokers, advertising networks, or analytics companies.

4. Where Your Data Is Stored

Account data, coaching conversation history, and health profile data are stored in the United States (Supabase US region). HealthKit data is read on your device and, when needed for coaching, processed in the US and not stored on our servers beyond the session unless you explicitly choose to sync history.

If you are located outside the United States, your information will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) in our sub-processor agreements for cross-border transfers where applicable.

5. AI Processing Disclosures

• Third-party AI:Coaching responses are generated by Anthropic’s Claude API. Anthropic is a sub-processor of CoyForge Dynamics.
• What is sent to Anthropic: Your coaching messages, relevant HealthKit data summaries (e.g., recent workouts, step counts, sleep), and your fitness profile. Raw granular HealthKit records are not transmitted; we send summarized data necessary for the coaching context.
• No training on your data:Under our agreement with Anthropic, your data sent via the API is not used to train Anthropic’s models. Anthropic’s default API terms auto-purge inputs and outputs within 30 days.
• AI answers can be incorrect. AI coaching recommendations are for informational purposes only. VividCoach is not a substitute for medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider before making significant changes to your exercise or diet regimen.

6. Apple HealthKit Disclosure (Mandatory)

“VividCoach accesses HealthKit data solely to provide AI-powered fitness and wellness coaching recommendations. Health data obtained from HealthKit is not shared with third parties for advertising purposes and is not used to build advertising profiles. Health data is not sold to data brokers or any third party. HealthKit data is used only to personalize and improve the coaching experience you receive within VividCoach.”

This disclosure is required by Apple’s HealthKit developer guidelines. Specifically:

• Purpose limitation: HealthKit data is used only to provide and improve coaching features within VividCoach. It is not used for any other purpose.
• No advertising use: HealthKit data is never used for advertising targeting, retargeting, or profile building.
• No third-party sale: HealthKit data is never sold to data brokers or marketing companies.
• No secondary use: We do not use HealthKit data for research, analytics unrelated to your coaching, or any purpose beyond your personal coaching service unless you explicitly consent.
• User control:You can revoke VividCoach’s HealthKit access at any time in iOS Settings → Privacy & Security → Health → VividCoach. Revoking access will disable HealthKit-driven coaching features but will not delete your account or manually entered data.

7. Data Retention

When you delete your VividCoach account, we delete your coaching conversations, health profile, and account data within 30 days, except residual encrypted backups (which expire within 7 days) and statutory billing records.

8. Your Choices and Rights

• HealthKit access:Manage at any time in iOS Settings → Privacy & Security → Health → VividCoach.
• Delete conversations: Delete individual coaching chats from within the App.
• Delete your account: From App Settings → Delete Account, or by emailing privacy@coyforgedynamics.com. We will complete deletion within 30 days and confirm in writing.
• Correct your profile: Update your fitness profile and goals in App Settings at any time.
• Export your data: Email privacy@coyforgedynamics.com to request a copy of your stored data.
• Opt out of marketing: Use the unsubscribe link in any marketing email.

California residents (CCPA/CPRA). You have the right to: (i) know what personal information we collect and how it is used; (ii) delete personal information; (iii) correct inaccurate personal information; (iv) opt out of sale or sharing of personal information (we do not sell or share for advertising). To exercise your rights, email privacy@coyforgedynamics.com.

European, UK, and Swiss residents (GDPR-aware). If GDPR or UK GDPR applies, you have the rights of access, rectification, erasure, restriction, portability, and objection. Email privacy@coyforgedynamics.com to exercise these rights. Data is processed in the United States; we rely on SCCs for EEA/UK/Swiss transfers.

9. Children

VividCoach is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email privacy@coyforgedynamics.com and we will delete the account.

10. Security

We use encryption in transit (TLS 1.2+) and at rest (AES-256, Supabase-managed), application-level access controls, and row-level security on health and coaching data. No system is 100% secure. If we discover a security incident affecting your data, we will notify you without undue delay as required by applicable law.

11. Sub-processors

We will give account holders at least 14 days’ notice by email before adding any new sub-processor that processes health or coaching data.

12. Changes to This Policy

We will update this Policy as the App evolves. Material changes — especially any change to how HealthKit data is used — will be communicated via in-app notification and email at least 14 days before the change takes effect.

13. Contact

CoyForge Dynamics — VividCoach Privacy Inquiries
Email: privacy@coyforgedynamics.com
General support: support@coyforgedynamics.com